Răsfoiți Sursa

qcacmn: Move pdev_obj_destroy_notification to avoid access freed pdev

Move wlan_mgmt_rx_reo_pdev_obj_destroy_notification before
wlan_objmgr_pdev_component_obj_detach to avoid access freed pdev memory

Change-Id: I4264773c4f6f92de36c827167ca5bd4f25b45041
CRs-Fixed: 3620074
Guru Pratap Sharma 1 an în urmă
părinte
comite
539df4d507

+ 8 - 6
umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_utils_api.c

@@ -299,12 +299,6 @@ static QDF_STATUS wlan_mgmt_txrx_pdev_obj_destroy_notification(
 
 	mgmt_txrx_debug("deleting mgmt txrx pdev obj, mgmt txrx ctx: %pK, pdev: %pK",
 			mgmt_txrx_pdev_ctx, pdev);
-	if (wlan_objmgr_pdev_component_obj_detach(pdev,
-				WLAN_UMAC_COMP_MGMT_TXRX, mgmt_txrx_pdev_ctx)
-			!= QDF_STATUS_SUCCESS) {
-		mgmt_txrx_err("Failed to detach mgmt txrx ctx in pdev ctx");
-		return QDF_STATUS_E_FAILURE;
-	}
 
 	status = wlan_mgmt_rx_reo_pdev_obj_destroy_notification(
 						pdev, mgmt_txrx_pdev_ctx);
@@ -313,6 +307,14 @@ static QDF_STATUS wlan_mgmt_txrx_pdev_obj_destroy_notification(
 		return QDF_STATUS_E_FAILURE;
 	}
 
+	if (wlan_objmgr_pdev_component_obj_detach(pdev,
+						  WLAN_UMAC_COMP_MGMT_TXRX,
+						  mgmt_txrx_pdev_ctx)
+			!= QDF_STATUS_SUCCESS) {
+		mgmt_txrx_err("Failed to detach mgmt txrx ctx in pdev ctx");
+		return QDF_STATUS_E_FAILURE;
+	}
+
 	wlan_mgmt_txrx_desc_pool_deinit(mgmt_txrx_pdev_ctx);
 	qdf_mem_free(mgmt_txrx_pdev_ctx->mgmt_txrx_stats);
 	qdf_runtime_lock_deinit(&mgmt_txrx_pdev_ctx->wakelock_tx_runtime_cmp);